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In the late 1970s, years before the Space Shuttle flew its maiden voyage, it was 
understood low liquid hydrogen (LH 2 ) Net Positive Suction Pressure (NPSP) at the inlet to 
the Space Shuttle Main Engine (SSME) could have adverse effects on engine operation. A 
number of failures within both the External Tank (ET) and the Orbiter Main Propulsion 
System (MPS) could result in a low LH 2 NPSP condition, which at extremely low levels can 
result in cavitation of SSME turbomachinery. Operational workarounds were developed to 
take advantage of the onboard crew’s ability to manually throttle down the SSMEs (via the 
Pilot’s Speedbrake/Throttle Controller), which alleviated the low LH 2 NPSP condition. 
Manually throttling the SSME to a lower power level resulted in an increase in NPSP, 
mainly due to the reduction in frictional flow losses while at the lower throttle setting. Early 
in the Space Shuttle Program’s history, the relevant Flight Rule for the Booster flight 
controllers in Mission Control did not distinguish between ET and Orbiter MPS failures and 
the same crew action was taken for both. However, after a review of all Booster operational 
techniques following the Challenger disaster in the late 1980s, it was determined manually 
throttling the SSME to a lower power was only effective for Orbiter MPS failures and the 
Flight Rule was updated to reflect this change. The Flight Rule and associated crew actions 
initially called for a single throttle step to minimum power level when a low threshold for 
NPSP was met. As engineers refined their understanding of the NPSP requirements for the 
SSME (through a robust testing program), the operational techniques evolved to take 
advantage of the additional capabilities. This paper will examine the evolution of the Flight 
rule and associated procedure and how increases in knowledge about the SSME and the 
Space Shuttle vehicle as a whole have helped shape their development. What once was a 
single throttle step when NPSP decreased to a certain threshold has now become three 
throttle steps, each occurring at a lower NPSP threshold. Additionally the procedure, which 
for early Space Shuttle missions required a Return-to-Launch-Site abort, now results in a 
nominal Main Engine Cut Off and no loss of mission objectives. 


I. Introduction 

Even before the first flight of the Space Shuttle on April 12, 1981, it was understood by the engineering and 
operations communities the Space Shuttle Main Engine (SSME) should not be allowed to operate at low Liquid 
Hydrogen (LH 2 ) Net Positive Suction Pressure (NPSP). However, at the time it was not fully understood what 
failures within the Space Shuttle Main Propulsion System (MPS) could result in this undesirable operating 
condition. This resulted in a very simple but non-optimal operational workaround involving the onboard flight 
crew, documented in the Space Shuttle Flight Rules for STS-1. As the Space Shuttle and SSME operational 
knowledge increased, this workaround underwent a number of iterations. The procedure contained in the Flight 
Rules for STS- 135 (the last Space Shuttle mission) differs greatly from the original version utilized by the Flight 
Control Team for STS-1. Most importantly, if needed during ascent, the changes made to the procedure over the 
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years would no longer result in a highly risky Return-to-Launch-Site (RTLS) abort but rather a nominal Main 
Engine Cutoff (MECO) and no loss of mission objectives. 

II. GH 2 Repressurization System Design Overview 

Before describing the changes to the procedure over the years, it is necessary to inform the reader (from an 
operations perspective) how sufficient LH 2 NPSP is maintained in a nominal ascent situation 1 . As liquid hydrogen 
is drained from the External Tank (ET), it must be replaced with a gas pressurant in order to maintain both ET 
structural integrity and sufficient LH 2 NPSP at the SSME inlet. For the Space Shuttle Vehicle, the pressurant is 
gaseous hydrogen (GH 2 ), which is delivered to the ET LH 2 tank from the SSME by way of the Orbiter. The GH 2 
used to pressurize the ET LH 2 tank is supplied by the SSME, which uses hydrogen as part of its regenerative cooling 
circuit. 

The GH 2 from each SSME is routed through the aft end of the Orbiter, where it passes through a flow control 
valve (the GH 2 line in the Orbiter for each SSME has its own dedicated flow control valve). The poppet-style flow 
control valves are shimmed so that the “closed” position is still 31% open, and the “open” position is only 70% 
open. This was done in the mid-1990s to minimize wear/tear on the valves, originally the “closed” position was still 
18% open and the “open” position was 100% open (the flow control valves were also reoriented in the aft 
compartment of the Orbiter, due to problems which will be discussed later). The GH 2 flow control valve is a 
normally-open valve and commanded (powered) closed when its dedicated signal conditioner reaches a pre- 
determined set point. Each of the three signal conditioners monitor a pressure from one of the three GH 2 Ullage 
Pressure sensors, located at the top of the ET LH 2 tank. The ullage pressure required for each signal conditioner to 
close its flow control valve is nominally 33.0 psia but, due to a deadband, could cause the flow control valve to close 
as low as 32.8 psia or as high as 33.2 psia. A cockpit switch located on Panel R2 in the Orbiter provides the crew 
manual control over the flow control valves, allowing them to open all three valves with a single switch throw. 
Nominally, however, the switch is in the Auto position allowing the signal conditioners to automatically activate 
(close) and deactivate (open) the flow control valves. 
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Figure 1. Space Shuttle Orbiter Flight Deck Panel R2 (LH2 Ullage Press switch 
circled) 







After the GH 2 from each SSME flows through its respective flow control valve, the three flow paths are 
combined into one and plumbed out of the Orbiter through the LH 2 ET/Orbiter 2” disconnect located on the 
Orbiter’s underside. The GH 2 then travels up the side of the External Tank and through an access hole in the ET 
Intertank (the ribbed area on the ET between the L0 2 and LH 2 tanks). Finally, the flow passes into the top of the 
LH 2 tank and through a diffuser. 


III. NPSP from an Operations Perspective 

It is also important to give a brief background of NPSP as it relates to SSME operation, as well as the various 
failures which could result in a low LH 2 NPSP condition. For the Booster Flight Control team, LH 2 Net Positive 
Suction Pressure is defined in Equation (1) as follows 2 : 

NPSP = Py + P H - Pp - Py where (1) 

Ppj = LH2 Tank Ullage Pressure 
Pfl = LH2 Head Pressure 
Pp = Frictional Flow Losses 
Py = LH2 Vapor Pressure 

NPSP has been calculated and available to the Booster Flight Control Team since STS-1, but modifications to 
the code that performs the operation have been made over time. Three of the terms in the NPSP equation are not 
considered to have credible failures associated with them and are not covered by the Booster Flight Rules, as 
discussed in the following paragraphs. 

P H is purely the head pressure associated with the column of liquid hydrogen in the ET. The only realistic way 
for the liquid hydrogen to escape the External Tank is for it to be consumed by the SSME. The Booster Flight 
Control Team does not treat a breach in the ET LH 2 tank as a credible failure mode, and thus the calculation for P H 
is solely based on the height of LH 2 in the External Tank (which decreases as a function of time), and the 
acceleration and attitude of the vehicle. However, due to the low density of LH2, P H is not a major term in the 
equation. At this point in the paper it should be stated for the Liquid Oxygen (L0 2 ) feed system, the density of L0 2 
and the vehicle acceleration effects make the P H term in the NPSP equation dominant, so the L02 feed system does 
not have the same sensitivities as the LH2 system during powered flight (until just prior to MECO). 

P F is a value dependent on the SSME position on the Orbiter (Center, Left, or Right), because the plumbing for 
liquid hydrogen is slightly different for each SSME on the Orbiter. It is also dependent on the commanded power 
level of the SSME (which can be commanded anywhere between 67% and 109% by the Orbiter’s onboard General 
Purpose Computers). The Booster console computation has the flexibility to automatically adjust the value used for 
P F based on the current power level of the SSME. However, the Booster Flight Control team does not consider any 
failures which would affect P F to be credible, thus, this term is not further modified to simulate specific failures. 

Third, P v is a function of the temperature of the LH 2 in the ET and Orbiter. The Booster team assumes the ET 
Thermal Protection System will work to keep the LH 2 sufficiently cooled and considers no other failures which 
would increase the bulk temperature of the LH 2 to be credible. The Booster NPSP console calculation assumes a 
constant, conservative temperature of LH 2 throughout ascent, which for current flights is the three-sigma high LH 2 
temperature as derived from previous flight data. It is understood there is a certain amount of temperature 
stratification that occurs with the bulk LH 2 in the ET, and work performed in the mid-2000s was able to show the 
Booster NPSP console calculation provides a conservative (higher than actual by about 0.5 psi) value of NPSP until 
approximately thirty seconds prior to Main Engine Cutoff (MECO) at which point it becomes slightly 
unconservative (lower by about 0.7 psi). The on-console Booster team is aware of this slight shortcoming in the 
computation and modifies their calls for crew action to account for this. A code change for the computation as a 
result of this analysis was not made due to the impending end to the Space Shuttle Program. 

The last term in the NPSP equation to be discussed is the Pu term, also known as ullage pressure. Although 
there are four terms which make up the equation for NPSP supplied to the SSME, the Booster Flight Control team 
only considers failures associated with this one to be realistic enough to warrant a Flight Rule documenting the 
workarounds. Since the ullage pressure in the ET LH 2 tank is actively controlled, there are a number of failures 
which can result in insufficient GH 2 pressurant reaching the ET LH 2 tank. A few of the ullage pressure failure 
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scenarios the Booster Flight Control Team might encounter on console will be discussed in this paper. It should be 
noted that since many single failures can be combined with one another to elicit different responses by the flight 
control team, the following discussion on failure scenarios should not be considered all-inclusive. 

IV. Failures in the GH 2 Repressurization System 

In the early days of the Space Shuttle Program, the operational response for all failures which affected LH 2 
NPSP was the same. Detailed reviews and increased knowledge of the Space Shuttle vehicle following the 
Challenger disaster in 1986 provided more insight into the impacts associated with these failures and identified a 
need to delineate between two very different failure scenarios. The first group of failures was categorized as “ullage 
leaks”, and are included in this paper for completeness even though the operational workarounds are much different 
than the other category of failures, known to the Booster flight control team as GH 2 Repressurization Anomalies. 

Ullage leaks are failures for which the loss of repressurization gas to the ET LH2 tank is not a function of the 
power level of the SSME. One example of this is a documented failure scenario where the ET LH2 Tank Vent 
Valve can fail partially open but still have the position indicator indicate it is closed 3 . This would allow ullage 
pressure to decay (venting overboard through the External Tank Carrier Assembly) with all flow control valves 
opened up in an attempt to hold pressure in the tank. For this failure scenario, throttling the SSME up or down will 
not help the leak because the leak rate is a function of the pressure in the tank and not a function of the mass flow 
rate of GH 2 into the tank. Until the Challenger disaster, however, the ullage leak failure scenario was treated in the 
same manner as the flow control valve failure scenario. It has since been discussed and decided to not throttle the 
SSMEs to maximum power level (currently 109% RPL) because the increase in repressurization mass flow due to 
the higher throttle setting is negated by the increase in LH 2 NPSP requirements. The current operational 
workaround for an ullage leak is to perform either a Transoceanic Abort Landing or an East-Coast Abort Landing, 
depending on the size and severity of the leak. 

The other classification of failures which can negatively impact LH 2 NPSP are known as GH 2 Repressurization 
Anomalies and their impacts on system performance are often a function of the actual power level of the SSME. 
First, an ullage pressure sensor could bias high or low, which would cause its associated flow control valve to close 
or open, respectively. The crew would not be directed to take any action for a single sensor bias, but two sensors 
biased high would result in the crew taking the cockpit switch to the Open position. The cockpit switch overrides 
the signal conditioners (which are responding to two or more erroneous ullage pressure readings) and opens all three 
flow control valves. 

Another failure which could affect the Pu term could be a broken flow control valve poppet 4 , which would lead 
to more GH 2 mass flow into the tank. This was seen in-flight during STS- 126 in November 2008 , but the risk of a 
failed poppet is currently mitigated by very detailed inspections of the flow control valve poppets before installing 
them on the vehicle. There are also filters located upstream of each flow control valve which could become clogged 
with contaminants 5 . These filters were installed in the mid-1990s to preclude contamination from causing sluggish 
flow control valve performance (discussed more later). However unlikely, the filter might get sufficiently clogged 
so as to not be able to provide the nominal mass flow of GH 2 . A single clogged filter may not sufficiently impact 
the ET repressurization rate so as to require the crew to manually throttle the SSMEs, since the other two flow 
control valves can open to compensate for the other’s lack of repressurization flow. 

The next failure example is another example of a GH 2 repressurization anomaly: a flow control valve failing in 
the powered (closed) 6 or un-powered (open) 7 state due to failures internal to the valve. A single flow control valve 
failing to the open position does not require any crew intervention, as the other two flow control valves can 
adequately manage the ullage pressure in the ET LH 2 tank. Two flow control valves failing to the open position 
could cause the ET LH2 Tank Vent Valve to automatically open in order to prevent an overpressurization. This 
could be catastrophic if the vent valve opened early in ascent when there is oxygen in the atmosphere available to 
burn. There are no crew/ground operations associated with two flow control valves failing in the open position, and 
the risks associated with venting GH 2 early in ascent have been accepted by the Space Shuttle Program. 

Finally, a single flow control valve failing in the closed position does not require operational workarounds, but 
two flow control valves failing closed can greatly affect the Pu term and require crew intervention. This failure 
scenario is also greatly dependant on the timing of the failures, and exacerbated when there is only a small ullage 
volume in the ET LH 2 tank as is the case early in flight. The scenario where two flow control valves fail closed 
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shortly after liftoff is the major failure case that can be mitigated by the crew’s use of manual SSME throttling, the 
history of which will be explained in the pages that follow. 

V. Early Space Shuttle Missions (1981-1986) 

A Preliminary Flight Rules revision 8 for Operational Flight Test-1 (OFT-1) of the Space Shuttle published in 
August 1978 provides insight into the fact that engineers and operations personnel understood the SSME should not 
be operated in low NPSP regimes (MPL in the quote below refers to Minimum Power Level, which at the time was 
65% of Rated Power Level). Booster Flight Rule 5-53 stated, “To maintain sufficient Net Positive Suction Pressure 
(NPSP) at the SSME interface, manual throttling to MPL will be used when LH2 Engine Manifold Pressure < TBD 
psia (secondary cue of LH2 Ullage Pressure < TBD psia)”. At this point in the Space Shuttle Program, 
approximately two and a half years before the first flight, specific details were being worked out relative to certain 
thresholds for taking action, as evidenced by the “TBD”. Factors that still had to be included in determining the 
final value at which to take action include the SSME/Orbiter hardware capabilities, the sensor inaccuracies, and the 
conservatism included in the action itself. 

It should be noted the first version of the flight rule does not make any distinction between ullage leaks and GH 2 
repressurization anomalies (the differences between the two were discussed in Section IV). The same action was 
going to be taken as long as the LH 2 Manifold pressure (and later, the NPSP) reached a certain low threshold. 

The Pilot (who sits in the starboard front seat on the Orbiter flight deck) is the crew member who would be 
performing the manual throttling actions. To take manual throttling control of the SSMEs, he would depress a 
button on the Speedbrake/Throttle Controller (SBTC), which is located next to his left leg (see Fig. 5). The 
“AUTO” light (indicating the SSME throttles were being controlled by the GPCs) located on Panel F4 to the right of 
the Pilot’s Heads-Up-Display and seen in Fig. 2 below would extinguish as a visual confirmation that the Pilot had 
pressed the button. When Manual Throttles were activated, a “MAN” light would illuminate just below where the 
AUTO light was located. With the “MAN” light illuminated, the Pilot could then manually throttle the SSMEs by 
moving the SBTC forward or aft. Early in the Space Shuttle Program, the SSMEs could be throttled between 65% 
and 107% Power Level (for contingency situations). The SBTC controls the throttle setting for all three SSMEs at 
once, and the full forward position is nominally 104.5% Power Level but can be increased to 109% Power Level for 
contingency situations, while full aft is 67% Power Level (current minimum power level). 



Figure 2. Space Shuttle Orbiter Panel F4 (Speedbrake/Throttle light circled) 


The version of the Flight Rules for STS-1 (which had changed from the previous designation of OFT-1) 
published in March of 1979 is the first time values for which the crew should take manual throttling action were 
formally documented by the engineering and operations communities 9 . Also documented in this version of the 
Flight Rule was the existence of a ground (located in the Houston Mission Control Center, or MCC) computation for 
NPSP. In what was designated Flight Rule 5-77, it was stated manual throttling (to Minimum Power Level, 65%) 
would be performed “when the MCC computed engine inlet NPSP <4.6 psia”. The previous version of the Flight 
Rule simply mentioned the LH 2 Manifold Pressure as a cue, which was to be displayed to the crew via a Systems 
Summary display page generated by the Backup Flight Software system. This implies there would need to be 
interaction between the Flight Control Team on the ground (who had insight into a calculated value for LH 2 NPSP) 
and the onboard flight crew and will remain a key to any operational workaround for this failure scenario. 
Communication between the ground and the flight crew must be maintained in order to execute the actions described 
this and all future revisions of the Flight Rules. Since the flight crew did not have insight into LH 2 NPSP, an 
onboard procedure would never be flown. 
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As with every other aspect of the Space Shuttle Program, there is a lot of work and discussion that goes into the 
development of each and every Flight Rule. However, to keep the actual rule concise and relatively easy to read, 
every documented Flight Rule has rationale included to supplement the text of the rule. The rationale for the STS-1 
Flight Rule on Manual Throttling mentions the two flow control valve failed closed failure scenario (it also mentions 
a flow restriction in two lines) as one which would require Manual Throttling. 

This early version of the procedure would also require a Return-to-Launch-Site (RTLS) abort as long as the 
Negative Return boundary had not been passed. Negative Return is the abort boundary at which the vehicle has too 
much downrange energy to be able to successfully complete the RTLS abort and occurs approximately three 
minutes and forty-five seconds into the flight. The Flight Rule rationale further describes how aborting RTLS 
would automatically throttle the SSMEs to minimum power level, which would avoid any crew interaction with the 
SSMEs. If the Negative Return Boundary had been passed, the flight would continue towards orbit with the SSMEs 
manually throttled down to 65% Power Level. 

The Flight Rules for STS-2 continue to demonstrate how knowledge about the Space Shuttle vehicle was 
constantly changing 10 . For example, the NPSP threshold to take manual throttling action was lowered slightly. The 
lower NPSP limit the SSME engineering community was comfortable running the engines down to was now 4.0 
psia, however, when instrumentation and computational inaccuracies were accounted for, the operations community 
would call the crew to take action when their ground computation decayed to 5.3 psia. The 1.3 psi difference was 
used to account for inaccuracies in the MCC computation, but it also represented the difference between the SSME- 
to-Orbiter Interface Control Document (ICD) NPSP limit of 5.3 psia and the point at which Rocketdyne was 
comfortable operating the SSME. The STS-1 Flight Rules did not explicitly account for this difference. 

STS-2 was also the first flight where an ullage pressure plot, as seen in Fig. 3 below, was added to the Flight 
Rule as a backup cue in the event the MCC computation failed to work properly. The curve was designed to protect 
the same minimum NPSPs as the MCC computation. This curve was included in the Flight Rules for STS-2 through 
STS-5 and changed somewhat each mission. It allowed progressively lower and lower ullage pressures, which 
shows the knowledge about the interaction between ullage pressure and NPSP granted the operations team more 
time operating the SSMEs at 100% Power Level before having to manually throttle the SSMEs to 65%. More time 
at 100% Power Level was desirable, because it decreased the possibility of having to perform an RTLS abort 
because it could possibly move the throttle-down threshold past the Negative Return boundary. 


B. MINIMUM ALLOWABLE LH 2 ULLAGE PRESSURE 



0 BASELINE LH 2 ULLAGE PRESSURE CONTROL 
BAND = 33 TO 35 PSIA 

0 CURVE MAINTAINS MINIMUM LH 2 NPSP OF 4.0 (5.3) PSI 


Figure 3. Ullage Pressure curve as approved for the STS-5 Flight Rules 
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STS -3 in March of 1982 was the first flight where a TAL abort recommendation was included in the Flight 
Rule 11 , for the cases where the Negative Return boundary had been passed but orbital velocity was not predicted to 
be achieved. However, if the low NPSP condition occurred early enough in powered flight where an RTLS could 
still be performed, the Flight Rule recommended an RTLS abort. 

The ullage pressure backup curve was eliminated for STS-6 and replaced with a table that provided the minimum 
allowable NPSP as a function of SSME Power Level 12 . This table can be seen in Fig. 4 below. STS-6 was the first 
flight of OV-099, Challenger, and also the first flight where the Mission Power Level was 104% of Rated Power 
Level. The 104% power level was the reason for the elimination of the backup ullage pressure table, because this 
provided another option for Mission Power Level (depending on the payload being taken to orbit) and would have 
required a second ullage curve. For simplicity, the team opted to eliminate the table and accept the risk of having 
the MCC-based computation break down. With five ascents completed already, the team likely felt confident in the 
code that ran the computation. The table, which was put in the Flight Rules for STS-6, remained there with the same 
values all the way until January 1986 when the Challenger disaster happened. 
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Figure 4. NPSP Table as approved for the STS-6 Flight Rules 


VI. Low NPSP Operations after STS-51L (1987-2005) 

The Challenger disaster, also known as mission STS-51L, brought about a complete review of all Space Shuttle 
operations and updates to numerous Flight Rules. The Booster Flight Rule governing operations at low LH2 NPSP 
was not exempt from this review and underwent major changes in the two-and-a-half years leading up to the first 
Return-to-Flight mission (STS-26R) on September 29, 1988. A big deletion from the Flight Rule used for STS-26R 
was the requirement for an RTLS or TAL abort for a low LH 2 NPSP failure situation. The team would attempt to 
get “uphill” due to the addition of what was probably the biggest change to this rule: the manual throttling action 
had expanded from a single step down to minimum power level to three incremental throttle steps down to minimum 
power level. 

The majority of the work done on changing the throttling actions was performed in early 1987. In February^ the 
first proposal for the new Flight Rule, which described three throttle steps, was released for review. It proposed 
throttling the SSME from 104% -> 100% ->90% ->65% Power Level, which lessened the trajectory impact due to 
decreased SSME impulse (increasing possibility of achieving orbit) compared to the old method of throttling 
immediately to 65% Power Level. However, this initial proposal did not recommend an NPSP threshold as the cue 
to throttle down. The new cue was for the MCC to call the crew to perform manual throttling when the Sensor B (at 
the time there were two sensors, A and B) High Pressure Fuel Turbopump (HPFTP) Turbine Discharge 
Temperatures (TDT) reached 1900 Rankine or the Fuel Preburner Oxidizer Valve (FPOV) position increased 3% 
from its nominal value at 104% power level. 


+ “Low Fuel Inlet NPSP Engine Effects”, unknown author, Presented to Propulsion Systems Integration Group, January 1987 
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1900 Rankine maintained 60 degrees margin to the HPFTP TDT redline shutdown threshold; the Sensor B 
temperatures were used at the time because this channel consistently measured higher discharge temperatures than 
its Sensor A counterpart. The SSME Testing program at the John C. Stennis Space Center in Mississippi helped 
discover the increase in HPFTP TDTs as a result of decreased LH2 NPSP. Analysis had also been done that showed 
the HPFTP temperatures increased by only 75 degrees even as NPSP decreased to 3.5 psia. It was believed the 
HPFTP TDT threshold would be reached before the FPOV cue, but the FPOV cue was provided in the event that the 
temperature sensor had been disqualified. This is significant because at the time, a disqualified temperature sensor 
was a high- visibility failure mode because an SSME had actually erroneously shut down in flight due to a 
combination of disqualified and erratic TDT sensors on STS-51F in July 1985. 

This recommendation would essentially have allowed the NPSP to decay far enough where the SSME HPFTP 
would start to cavitate. At the point of noticeable cavitation (via the HPFTP TDTs) and due to time delays in the 
transmission of telemetry, it may have been too late for the MCC to intervene before a catastrophic event would 
occur. Due to the vast changes from the previous single throttle step Flight Rule, it is the author’s opinion that this 
proposal received a lot of discussion when it was presented to a Propulsion Systems Integration Group (PSIG) 
meeting in early 1987. In the end, the decision was made to retain NPSP as the primary cue to perform the manual 
throttling actions. 

Moreover, the initial throttle steps and cues were not the final ones that ended up in the operational Flight Rules 
for the first Return-to-Flight mission in 1988. The throttle steps, cues, and the eventual re-introduction of NPSP 
thresholds went through a number of revisions over the next year and a half. Rocketdyne noticed their initial 
proposal for a throttle step to 90% was going to lower the SSME power level to a point where it could bring the 
Phase II SSME HPFTP impeller to resonance (not a concern for the current Block II SSME). The power levels of 
concern were between 88% and 92% Rated Power Level. To avoid this region while maintaining three distinct 
throttle steps, the new proposal in April 1987 was to throttle from 104% -> 96% -> 80% -> 65%. These throttle 
steps were selected to optimize SSME impulse while still avoiding the HPFTP impeller resonance region. This new 
proposal only received a minor update prior to the official publication of the Flight Rules for STS-26R (Return-to- 
Flight) in May 1988. The 96% throttle step was changed to 95%, possibly solely on the basis that 95% is an easier- 
to-remember target for the crewmember. 



Figure 5. Space Shuttle Orbiter Center Console (Speedbrake/Throttle Controller circled) 
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The throttle cues also underwent a few revisions prior to being published in May 1988. As was mentioned 
previously, in February 1987 the prime cue to throttle the SSMEs was recommended to be the HPFTP TDTs with an 
FPOV position increase of more than 3% as the backup cue. This was later modified in April 1987 to again rely on 
an NPSP threshold but still monitor the HPFTP TDTs as a backup, with new temperature thresholds established*. 

The Flight Control Team would monitor for the Sensor A temperatures to increase above 1740 Rankine and the 
Sensor B temperatures to increase above 1850 Rankine. These values were selected as they were both 110 degrees 
below the updated HPFTP TDT redline shutdown threshold of 1850 R for Sensor A and 1960 R for Sensor B, while 
still being high enough to avoid erroneously throttling the SSMEs due to nominal operating temperature excursions. 
The FPOV cue was dropped from the Flight Rule in that revision, because the NPSP cue was reinstated as the 
primary throttling cue. With NPSP again used by the Flight Control Team, the FPOV position only would exist for 
the case where the MCC computation stopped working, and there were temperature sensor failures in addition to 
two flow control valve failures, now a highly-unlikely five failure deep scenario. 

A final revision at the time, and the one that ended up in the STS-26R Flight Rules 13 , further modified the 
HPFTP TDT cue, changing it to have the Flight Control Team initiate the stepped manual throttling procedure when 
the temperatures increased to within 75 degrees of their redline values. This was based on analysis and test stand 
data, and allowed slightly longer operation at a high power level before throttling down while still avoiding 
cavitation of the High Pressure Fuel Turbopump. 

Another element of the Flight Rule to change was the NPSP threshold at which the manual throttling would be 
performed. Remember, before the Challenger disaster the NPSP threshold was a function of the power level of the 
SSME. This had been a relevant table to have, because some missions flew with the SSMEs operating at 100% 
Rated Power Level and others flew with the SSMEs at 104% Rated Power Level. Additionally, there were plans in 
the works to deliver payloads to orbit that were so large it would require the SSMEs to operate nominally at 109% 
Rated Power Level (this capability had previously been reserved for contingency operations only). These plans 
were abandoned as part of the reviews before Return -to-Flight, so the references to 109% Power Level were once 
again contingency operations and, when combined with two flow control valve failures, no longer credible. Further, 
no flights were manifested to use 100% Power Level as the nominal Mainstage power level so references to this 
setting were no longer required. 

Following extensive SSME testing it was determined the SSME could safely operate with LH 2 NPSP as low as 
3.5 psia. It had been demonstrated on the test stand that the HPFTP TDTs would increase approximately 75 degrees 
as the NPSP dropped from a nominal value down to 3.5 psia but the SSME would not experience a catastrophic 
cavitation event. However, the “cliff’ where the cavitation would reach a point where crew intervention could not 
recover safe operation of the SSME was unknown, mostly because it was undesirable to cause damage to the test 
stand in the event LH 2 NPSP could not be restored to the SSME before a catastrophic shutdown occurred. Through 
testing, the team knew there was margin below the 3.5 psia NPSP limit but the extent of that margin was unknown. 

Even with the elegant manual throttling procedure developed as part of the Retum-to-Flight efforts, analysis had 
shown the Phase II SSME (the version of the SSME being used at the time) would not reach 3.5 NPSP prior to 3-G 
throttling (which occurs approximately one minute prior to MECO) for two flow control valves failed closed § . The 
automatic 3-G throttling performed by the Orbiter would work just like the manual procedure to increase NPSP, 
leaving the manual throttling as a contingency plan if the analysis were wrong for some reason. This is the reason 
for removing the words that recommended an RTLS/TAL abort for two flow control valves failed closed. As the 
SSME evolved to the Block I, Block IIA, and Block II versions, however, the manual throttling procedure would 
become critical for achieving a nominal MECO if two flow control valves failed closed at liftoff (discussed later). 

A further addition to the Flight Rule for STS-26R was an action for the crew to take the Main Engine Limit 
Shutdown switch located on Panel C3, as seen in Fig. 6, to the “Enable” position once the SSMEs had been throttled 
down to 95%. This was added to allow multiple SSME shutdowns (on the HPFTP TDT redline) to occur 
automatically if a failure caused the NPSP to drop too quickly for the flight control team and crew to respond with 
manual throttling. Further discussion of the operation of the switch is outside the scope of this paper, but the Main 
Engine Limit switch has three positions (Enable, Inhibit, and Auto) and with the switch in the Auto position (as it is 
for launch) only the first automatic SSME redline shutdown is permitted. 


* “Review of flight rules”, Letter from JB Woodside to Jerry Borrer and Jenny Howard, April 27, 1987. 

§ “Low Fuel Inlet NPSP Engine Effects”, unknown author, Presented to Propulsion Systems Integration Group, January 1987 
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Figure 6. SSME Limit Shutdown Control Switch on Space Shuttle Orbiter Panel C3 

The manual throttling procedure remained the same until a few minor updates were made in 1994. First, the 
crew actions to take the Main Engine Limit Shutdown switch to Enable would now be performed as soon as the 
Flight Control Team recognized and confirmed the flow control valve failure situation and not after the first throttle 
step to 95%. This was done to protect for multiple SSME shutdowns due to low LH 2 NPSP at 104% PL (before 
manual throttling was initiated). 

Second, the throttle step to 65% needed to be changed because an update to the Minimum Power Level for the 
SSME was made approximately three years prior 14 . Minimum Power Level is a variable parameter in the Orbiter 
Flight Software known as an Initialization Load, or I-Load. I-Loads can be changed on a flight -to-flight basis, if 
required. MPL was now 67% and had been changed due to a bistability region for the Preburner Boost Pump^ (PBP, 
and located directly below the Pump end of the High Pressure Oxidizer Turbopump) while at 63% Power Level and 
was discovered while running SSMEs on the test stand in Mississippi. It was concluded the 65% throttle setting did 
not leave enough margin to the bistability region, so the minimum throttle setting was increased to 67%. It should 
be noted a few SSMEs exhibited bistability running on the test stand at 65% power level, and minimum power level 
for flights with those SSMEs (ex: STS-63 in 1995) was increased as high as 69%. Updating the Minimum Power 
Level I-Load in the Orbiter flight software (and later in the Flight Rule) did not have an effect on flight controller or 
crew training, however, because the crews were trained to pull the SBTC full aft to set minimum power level, 
regardless of what power level would actually be commanded. 

The Flight Rules used for STS-93 in March 1999 incorporated three changes to the Flight Rule governing actions 
for low LH 2 NPSP due to recent flight experience and subsequent vehicle modifications 15 . Sluggish flow control 
valve performance was observed on flights in the mid-1990s and contamination was suspected to be a contributor. 
In the 1995-1996 timeframe, the flow control valves (located in the aft compartment) were reoriented to preclude 
downstream contamination from settling on the flow control valve poppet when the Orbiter was in the vertical 
position. This is also when the “shimmed” flow control valves mentioned earlier in this paper were implemented. 
Further, filters were added on each Orbiter to trap contamination upstream of each of the three flow control valves. 
This new filter also presented the unlikely failure mode that it could become clogged, exhibiting a similar effect as a 
flow control valve failed in the closed position. Since the flow control valve failure wasn’t the only failure giving 


11 “SSME S/N 2032 Bistable High Pressure Oxygen Turbopump (HPOT)”, Booster Systems Section Weekly Activity Report, 
October 16, 1990. 
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this signature anymore, sub-paragraph B in the Flight Rule was renamed “Orbiter GH 2 Pressurization System 
Anomaly” instead of “GH 2 Flow Control Valve Anomaly”. 

Additionally, words were added which directed the crew to throttle down the SSMEs when vehicle acceleration 
reached 3-Gs, regardless if the LH 2 NPSP had decayed to 3.5 psia or not. The automatic 3-G throttling flight 
software task gets disabled once the flight crew engages manual throttles, so the ground would call the crew to 
actively throttle to maintain 3-Gs if required. 

VII. Final Updates and Current Operations (2006-current) 

The last update to the manual throttling for low LH2 NPSP Flight Rule 16 occurred in 2007 but was a result of a 
lot of work performed in 2006 as a result of Pratt & Whitney/Rocketdyne’s (PWR’s) investigation 17 into an ascent 
ullage leak simulation scenario given to the Booster Flight Control Team that year. In the simulation, the SSMEs 
safely shut down on their HPFTP TDT redline when the simulated LH 2 NPSP reached 1.6 psia. This was not the 
signature the engineers at PWR expected if this were to occur in real life and they initiated work to determine a more 
realistic failure signature. Their conclusion was presented to the Ascent/Entry Flight Techniques panel (A/E FTP) in 
May 2006 and declared the LPFTP would cavitate before the HPFTP, thus negating the operational controls for an 
Integrated Hazard Report which said the HPFTP TDT redline would protect the SSMEs if NPSP decayed low 
enough. In other words, the Block II SSME LPFTP was predicted to cavitate catastrophically before the HPFTP 
TDT redline would be reached. This is specific to the Block II SSME, which had different turbopumps (among 
other changes) than the Phase II SSME, on which the 1988 Flight Rule mentioning HPFTP temperatures as a backup 
cue was based. Nevertheless, the HPFTP temperature backup cue was retained in the flight rule in the event the 
analysis was incorrect. 

Further, as part of the investigation, the engineers at PWR were able to confidently say the SSME could safely 
run with NPSP as low as 3.0 psia NPSP at 67% Power Level. This was based on both test and analysis for the Block 
II SSME. There was limited experience with SSMEs operating with NPSP less than 3.0, but operation was stable 
when it was tested just below that threshold. A few actions were assigned to PWR and Mission Ops following the 
A/E FTP in May 2006, one of which was to examine performing all manual throttle actions at 3.0 psia NPSP. 
Additional investigations determined taking all manual throttle actions at 3.0 psia NPSP (rather than 3.5 psia) was 
safe to do and results 18 were presented to the A/E FTP in February 2007. 

With the new cue of 3.0 psia to initiate manual throttling at all power levels, analysis by Boeing Integrated 
Propulsion indicated a nominal MECO with no underspeed would result if this procedure had to be implemented due 
to two GH 2 flow control valves failed closed at liftoff. Because the analysis indicates the calculated NPSP might 
still decay to 3.0 psi after the final throttle step, an SSME may have to be shut down pre-MECO (the Flight Control 
Team would direct the crew to push the shutdown pushbutton for one of the SSMEs at Vi = 23,000 ft/sec), but the 
conservatism in the analysis said this might not need to be performed and would depend on day-of-launch factors. 
This is in contrast to when manual throttling was performed at 3.5 psia NPSP, which was predicted to result in a 90 
ft/sec underspeed at MECO. The first flight implementation of the latest version of the manual throttling procedure 
was STS-1 17 in June 2007. 

A final modification to the Flight Rule in 2007 did not affect the manual throttling actions, but changed the way 
the Main Engine Limit Shutdown switch was moved on Panel C3. Since the manual throttling actions would extend 
the time at which MECO would occur, it opened up a vulnerability in the SSME Controller software that can shut 
down an SSME due to erroneous commanding on a single command channel (there are three command channels 
total) if certain criteria are met. A way to disable that logic is to send a command to Inhibit Main Engine Redlines, 
and can be done by the crew via the switch on Panel C3. The update to the rule had the crew momentarily take the 
switch to Inhibit, then to Enable which eliminated the vulnerability. After that update in 2007, no further changes or 
updates to the Flight Rule have been proposed. 


VIII. Conclusions 

The Flight Rule which defines the operational workarounds for managing failure situations resulting in low LH2 
NPSP at the SSME inlet has undergone extensive reviews and rewrites over the thirty-plus years of the Space 
Shuttle Program. It has, like many of the other complex integrated systems which make up the Space Shuttle 
Vehicle, benefited from the increased knowledge resulting from a rigorous ground test program, technologically 
advanced analysis tools, and a cooperative relationship between the operations and engineering communities. 
Unlike the procedure in the original Flight Rule used for STS-1, which directed the flight control team to call the 
flight crew to execute an RTLS abort, the current Flight Rule allows the crew to continue to a nominal MECO with 
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no loss of ISS mission objectives. Given the importance of the on-orbit TPS inspections now required as part of the 
Columbia Accident Investigation Board recommendations 19 in 2004, this amounts to a significant reduction in risk 
to the crew if this failure scenario were to ever manifest itself during a Space Shuttle ascent. 

Author's Note: The final mission of the Space Shuttle Program, STS-135, launched July 8, 2011. Throughout the 
history of the Space Shuttle Program, the Booster Flight Control Team never had to implement the actions of Space 
Shuttle Operational Flight Rule A5-155 “Limit Shutdown Control, Manual Throttling, and Manual Shutdown for 
Low LH2 NPSP”. 
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Purpose 



• To describe how techniques used by Space Shuttle Booster 
Flight controllers to prevent excessively low liquid hydrogen 
(LH 2 ) Net Positive Suction Pressure (NPSP) during ascent 
have evolved throughout the life of the Space Shuttle Program 



Launch of STS-135 on July 8, 2011 
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GHo Pressurization System Overview 



• Used to maintain External Tank (ET) LH 2 tank structural integrity and LH 2 
NPSP at the Space Shuttle Main Engine (SSME) inlet 


• Gaseous hydrogen (GH 2 ) is routed from each SSME through the Orbiter up to 
the top of the ET LH 2 tank 


• Tank pressure actively controlled during ascent to 33 ± 0.2 psia 




- Three flow control valves (FCVs) are opened (70% flow) and closed (30% flow) based on a 
corresponding ET LH 2 Ullage Pressure sensor reading 


GH 2 pressurization line to 
top of ET LH 2 tank, enters 
through ET Intertank 


GH 2 pressurization line 
exiting Orbiter 
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NPSP and Mission Operations 

• NPSP as defined by Mission Operations: 

- NPSP = P u+ P h -P f -Pv 

- where: 

• Py = ET LH 2 Tank Ullage Pressure 

• P H = LH 2 Head Pressure 

• P F = Propellant Line Frictional Losses 

• P v = Bulk LH 2 Vapor Pressure 

• Operationally, only want to consider failures which are credible 

- As such, failures resulting in changes to P H (tank breach), P F (Orbiter propellant line 
frictional flow change), and P v (increase in bulk ET LH 2 temperature) are not covered by 
the Space Shuttle BOOSTER Flight Rules 

- Failures modifying Py term categorized as either ullage leaks or GH 2 pressurization system 
anomalies 

• Ullage Leaks - Independent of SSME Power Level 

• GH 2 pressurization system anomaly - Function of SSME Power Level 

- Flow control valve broken poppet, failed open, failed closed, clogged filter 

- One FCV failed open or closed: no crew/ground action required 

- Two FCVs failed closed: can be mitigated by manually throttling the SSMEs to a lower power level 
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How to Manually Throttle the SSMEs 



• Pilot (Right Front seat) depresses the red button on the Speed brake/Throttle 
Controller (SBTC) 

- “AUTO” light on SPD BK/THROT pushbutton indicator (pbi) extinguishes 


• Located at eye-level on a forward panel (F4) in front of the Pilot 


• When the throttle command coming from SBTC matches the current SSME throttle 
setting within a certain tolerance, manual throttling of the SSMEs is enabled 


- “MAN” light on SPD BK/THROT pbi illuminates 
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SBTC: 

• Full Forward -104.5%/1 09% PL 

• Full Aft - 67% PL 

• Same PL command to all 3 SSMEs 


SPD BK/THROT pbi 




Space Shuttle Missions From 1981 to 1986 

• Same operational workarounds for Ullage Leaks and GH 2 repress anomalies 

• STS-1 : Manually throttle SSMEs to minimum Power Level (65%) when NPSP 
was calculated (in Mission Control) to be less than 4.6 psia. Return-to- 
Launch Site (RTLS) abort required, if able. 

- Communication between ground and crew required to deal with this failure scenario 

- Prior to STS-1 , consideration given to use LH 2 manifold pressure as cue 

• STS-2 and subs: Lowered NPSP threshold (4.0 psi), but also accounted for 
MCC computation variability. New low limit was 5.3 psia 

- Ullage pressure plot in the event of an MCC console crash (see backup) 

• STS-3 and subs: Transoceanic Abort Landing (TAL) abort included as an 
option if RTLS no longer available (see backup for current abort boundaries) 

• STS-6 and subs: Eliminated ullage pressure plot, incorporated a table with 
NPSP minimums based on current SSME power level (100%, 104%, 109%) 

- Nominal 104% power level now an option; 109% used for contingencies 
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Missions Between 1988 and 2007 

• Determined Ullage Leaks and GH 2 repress anomalies needed to be treated 
differently operationally 

- For ullage leaks, wanted to stay at 1 04% Power Level (abort TAL) 

• Instead of a single throttle step to minimum Power Level, a stepped approach 
was taken 

- Optimized impulse while avoiding excessively low NPSP 

- Many iterations in 1987, eventually settled on 104% -> 95% -> 80% -> 65% 

- No longer required an RTLS or TAL abort for this situation - “press uphill” 

- LH 2 NPSP cue for throttling lowered to 3.5 psia 

• New backup cue - throttle down the SSMEs when the High Pressure Fuel 
Turbopump (HPFTP) turbine discharge temperatures (TDTs) rose to within 75 
degrees of their redline values 

- Increased HPFTP TDTs were a sign of pump cavitation 
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Missions Between 1988 and 2007, cont’d 

• Other minor Flight Rule modifications: 

- Main Engine Limit Shutdown switch to Enable position (1994) 

- Update minimum Power Level from 65% to 67% (1 995) 

- Change rule nomenclature from “Flow Control Valve Anomaly” to “GH 2 pressurization 
system anomaly” (1999) 

• Clogged filter results in similar system response 

• Filter added and FCVs re-oriented in each orbiter in 1995-96 timeframe due to sluggish in-flight FCV 
response 
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Missions from 2007 to 201 1 


Last major update resulted from an ascent simulation scenario (LH 2 tank 
ullage leak) given to the Booster Flight Control Team in 2006 

- LH 2 NPSP decayed to less than 2 psia and the SSMEs shut down on their High Pressure 
Fuel Turbopump TDT redline 

This was not the response engineers at Pratt & Whitney/Rocketdyne expected 
as NPSP decayed below the Flight Rule limits 

- Expected Low Pressure Fuel Turbopump to catastrophically cavitate before the High 
Pressure Fuel Turbopump temperature redline was violated 

- Block II SSME HPFTP less susceptible to cavitation than its Phase II SSME predecessor 

- Recall, backup cue for manual throttling was to monitor for a rise in HPFTP TDTs 

Temperature cue retained in Flight Rule, but inadequacies were documented 
in the Flight Rule Rationale 

Further work and SSME testing as a result of these discussions found all 
throttle actions could be taken at LH 2 NPSP of 3.0 psia 

- For 2 FCV failed closed at liftoff, resulting analysis showed a nominal Main Engine Cutoff 
(MECO) was achieved with no “underspeed” - no loss of mission objectives 

- Previously, with throttle steps at LH 2 NPSP of 3.5 psia, a 90 ft/sec underspeed was 
expected - possible loss of mission objectives 
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Ascent Simulation: Manual Throttling Actions 
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Conclusions 


Risk associated with the operational workarounds for GH 2 repressurization 
anomalies has greatly decreased over the life of the Space Shuttle Program 

Initially, an RTLS abort was required per the Flight Rules 

After many iterations, for 2 FCV failed closed at liftoff, a nominal MECO is 
predicted to be achieved by gradually decreasing the SSME commanded 
power level through manual inputs by the flight crew 

An onboard procedure has never flown due to limited crew insight into the 
system performance 

- Mainly, due to a lack of insight into LH 2 NPSP 

The Booster Flight Control team never had to implement the actions for low 
LH 2 NPSP 

- Governing Flight Rule: A5-155 “Limit Shutdown Control, Manual Throttling, and Manual 
Shutdown for Low LH 2 NPSP” 


12 


Rick Henfling::281 -483-2801 "September 201 1 


BACKUP 
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Ullage Pressure Backup Table 


ITEM 


5-35 


FLIGHT RULES 


MANUAL THROTTLING FOR LOW LH? NPSP 


A MANUAL ENGINE THROTTLING TO 65 PERCENT RPL HILL BE PERFORMED TO MAINTAIN 
THEM IN IMUM REQUIRED LHg NET POSITIVE SXTION PRESSURE (NPSP) AT THE 
ENGINE INLET WHEN THE MCC-COMPUTED ENGINE INLET NPSP < 4.0 (5-3} PS I. 

AS A BACKUP TO THE MCC-COMPUTED NPSP, LH 2 ULLAGE PRESSURE WILL BE USED 
FOR THE MCC THROTTLE DETERMINATION SUPPORTED BY THE INFORMATION SHOWN 
BELOW. 

B. MINIMUM ALLOWABLE LHj ULLAGE PRESSURE 



TIME FROM LIFTOFF - SECONDS 

0 BASELINE LH 2 ULLAGE PRESSURE CONTROL 
BAND = 33 TO 35 PSIA 
(J) CURVE MAINTAINS MINIMUM LHg NPSP OF 4*0 (5.3) PS I 


0437. ART* 7 


Reference: NSTS 12820, Space Shuttle Operational 
Flights Rules for STS-5 
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Space Shuttle Abort Boundaries 


Pwssto 
Press 1 q MECO 



Launch Vatooity ► 


Figure 2-1. Abort calls as a function of velocity and altitude 


Reference: Intact Ascent Aborts Workbook, Document #: USA0071 51 
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Main Propulsion 
System Operator 
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Main Engine 
Operator 
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